Add Prometheus metrics for connections, firewall, L7, and bytes transferred

Instrument mc-proxy with prometheus/client_golang. New internal/metrics/
package defines counters, gauges, and histograms for connection totals,
active connections, firewall blocks by reason, backend dial latency,
bytes transferred, L7 HTTP status codes, and L7 policy blocks. Optional
[metrics] config section starts a scrape endpoint. Firewall gains
BlockedWithReason() to report block cause. L7 handler wraps
ResponseWriter to record status codes per hostname.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -49,6 +49,7 @@ go test ./internal/sni -run TestExtract
 - `internal/l7/` — L7 TLS termination, `prefixConn`, HTTP/2 reverse proxy with h2c backend transport
 - `internal/server/` — orchestrates listeners → PROXY protocol → firewall → SNI → route → L4/L7 dispatch; per-listener state with connection tracking
 - `internal/grpcserver/` — gRPC admin API: route/firewall CRUD, status, write-through to DB
+- `internal/metrics/` — Prometheus metric definitions and HTTP server; optional `[metrics]` config section
 - `proto/mc_proxy/v1/` — protobuf definitions; `gen/mc_proxy/v1/` has generated code
 
 ## Signals